Method and apparatus for facilitating efficient authenticated encryption
View Patent ↗A shared-key encryption scheme that uses identically keyed block-cipher calls, low additional overhead, supports the encryption of arbitrary-length strings, produces a minimal-length-ciphertext, and is fully parallelizable. In one embodiment, “OCB”, a key shared between communicating parties is mapped to a key variant using the block cipher. The key variant is mapped into a sequence of basis offsets using shifts and conditional xors. To encrypt a message using a nonce, a nonce-dependent base offset is formed, and then a sequence of offsets is constructed by starting with the base offset and then xoring, for each offset, an appropriate basis offset. The message is partitioned into message blocks of the same length as the block length of the block cipher, along with a message fragment that may be shorter. Each message block is combined with a corresponding offset, enciphered, and then combined again with the offset, yielding a ciphertext block. The message fragment is xored with an appropriately computed pad to give a ciphertext fragment. A checksum is formed using the message blocks, the message fragment, and the pad. The checksum is combined with an offset and enciphered to yield a tag. The encrypted message includes the ciphertext blocks, the ciphertext fragment, and the tag.
1. A computer-implemented authenticated-encryption method that provides for associated-data, the method depending on a pseudorandom function and an authenticated-encryption method that does not provide for associated-data, wherein encryption of a message into a ciphertext is achieved by:
encrypting the message with the authenticated-encryption method that does not provide for an associated data to determine a ciphertext core and an authentication tag;
applying the pseudorandom function to the associated-data to determine an associated-data authenticator; and
defining the ciphertext to be the ciphertext core together with an xor of the authentication tag and the associated-data authenticator.
2. A computer-implemented authenticated-encryption method that provides for associated-data, the method depending on an authenticated-encryption method that does not provide for associated-data, wherein encryption of a message into a ciphertext is achieved by:
encrypting the message with the authenticated-encryption method that does not provide for an associated data to determine an initial ciphertext;
applying the pseudorandom function to the associated-data to determine an associated-data authenticator;
selecting a portion of the initial ciphertext;
modifying said portion of the initial ciphertext by xoring it with the associated-data authenticator; and
defining the result as the ciphertext.
3. A computer-implemented authenticated-encryption method that provides for associated-data, the method depending on an authenticated-encryption method that does not provide for associated-data, wherein encryption of a message into a ciphertext is achieved by:
encrypting the message with the authenticated-encryption method that does not provide for an associated data to determine an initial ciphertext;
applying the pseudorandom function to the associated-data to determine an associated-data authenticator; and
modifying the initial ciphertext with the associated-data authenticator to create the ciphertext.
4. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform an authenticated-encryption method that provides for associated-data, the method depending on a pseudorandom function and an authenticated-encryption method that does not provide for associated-data, wherein encryption of a message into a ciphertext is achieved by:
encrypting the message with the authenticated-encryption method that does not provide for an associated data to determine a ciphertext core and an authentication tag;
applying the pseudorandom function to the associated-data to determine an associated-data authenticator; and
defining the ciphertext to be the ciphertext core together with an xor of the authentication tag and the associated-data authenticator.
5. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform an authenticated-encryption method that provides for associated-data, the method depending on an authenticated-encryption method that does not provide for associated-data, wherein encryption of a message into a ciphertext is achieved by:
encrypting the message with the authenticated-encryption method that does not provide for an associated data to determine an initial ciphertext;
applying the pseudorandom function to the associated-data to determine an associated-data authenticator;
selecting a portion of the initial ciphertext;
modifying said portion of the initial ciphertext by xoring it with the associated-data authenticator; and
defining the result as the ciphertext.
6. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform an authenticated-encryption method that provides for associated-data, the method depending on an authenticated-encryption method that does not provide for associated-data, wherein encryption of a message into a ciphertext is achieved by:
encrypting the message with the authenticated-encryption method that does not provide for an associated data to determine an initial ciphertext;
applying the pseudorandom function to the associated-data to determine an associated-data authenticator; and
modifying the initial ciphertext with the associated-data authenticator to create the ciphertext.
7. A circuit to perform authenticated-encryption that provides for associated-data, the circuit comprising:
circuitry to encrypt a message using an authenticated-encryption technique to obtain a ciphertext core and an authentication tag, wherein the authenticated-encryption technique does not provide for an associated-data;
circuitry to apply a pseudorandom function to the associated-data to obtain an associated-data authenticator; and
circuitry to create ciphertext, wherein the ciphertext is the ciphertext core together with an xor of the authentication tag and the associated-data authenticator.
8. The circuit of claim 7 , wherein the circuit is an application-specific integrated circuit (ASIC).
9. The circuit of claim 7 , wherein the circuit is a field-programmable gate array (FPGA).
10. A circuit to perform authenticated-encryption that provides for associated-data, comprising:
circuitry to encrypt a message with an authenticated-encryption technique to determine an initial ciphertext, wherein the authenticated-encryption technique does not provide for an associated data;
circuitry to apply a pseudorandom function to the associated-data to obtain an associated-data authenticator; and
circuitry to modify the initial ciphertext with the associated-data authenticator to create ciphertext.
11. The circuit of claim 10 , wherein the circuit is an application-specific integrated circuit (ASIC).
12. The circuit of claim 10 , wherein the circuit is a field-programmable gate array (FPGA).